Stephen Kai-yi WONG, BarristerPrivacy Commissioner for Personal Data,

Hong Kong, China

American Bar Association Spring Meeting 2020 (Virtual) –

Tech Innovations at the Privacy Edge

Facial recognition and COVID-19 measures -

An overview from the perspectives of Hong

Kong and mainland China

27 May 2020

Traditional Chinese culture emphasises the interests of society and family.

2

Differences in Privacy Culture

The protection of personal information is

not emphasised until technological

developments in recent years.

155 years of British colonial rule has brought in

the Western culture and regulations on privacy

as fundamental human right.

Mainland Chinese authorities have passed

or revised a host of laws since 2010 to

address various privacy issues.

Privacy-related regulations include the UN ICCPR

(later mirrored by the Hong Kong 1991 BORO);

and the 1995 PDPO, the protection of which is

enshrined in the Basic Law (constitutional

document of Hong Kong SAR).

The Chinese phrase close to the meaning of privacy is “yin si”, the protection of

which was not practiced due to historical, cultural and political background.

Mainland of China Hong Kong SAR

➢ An estimated 770 million

surveillance cameras installed

around the world today.

➢ The number will be 1 billion +

by 2021.

➢ More than half of the world’s

surveillance cameras will be

in the mainland of China.

Source: IHS Markit (2019) 3

Source: Quartz (2018)4

• Police captured multiple fugitives

who attended the singer Jacky

Cheung’s concerts in 2018, by

using surveillance cameras

equipped with facial recognition

technology.

Source: SCMP (2018)

• A school in eastern China

reportedly installed cameras to

monitor pupils’ facial expressions

and attentiveness in class.

• The cameras, described as

“teaching assistants”, gave

teachers real-time information on

their students.

5

• Zhengzhou is the first city in

mainland China to roll out face

recognition payment systems for

subway networks.

• Nearly 200,000 commuters in

Zhengzhou elected to authorise

face-scan payments from Sep to

Dec 2019.

Source: SCMP (2019) 6

A shopkeeper in Chongqing once

told a western reporter,

“Chinese people don’t care about

privacy. We want security… It’s still

not enough cameras. We need

more.”

Public opinions of surveillance are mixed in mainland China

“It’s the best way to manage a

complex country with the world’s

biggest population. If, as our

government says, every corner of

public space is installed with cameras,

I’ll feel safe.”

– A marketing professional in mainland

China, stated in an interview.

Source: Australian Broadcasting Corporation (2018)

Source: Time (2019)

7

Edelman Trust Barometer 2020:

• Mainland China topped the

Trust Index with 82 points

• People in mainland China had a

high level of trust in the

government, NGOs, businesses

and the media

Public trust in the

Government is high

8

Concerns about the private sector using facial recognition

① Survey by a Beijing research

institute (2019):

• 74% respondents wanted the option

of traditional authentication

methods over facial recognition

• 80% were concerned that facial

recognition system operators had

lax security measures

Source: The Guardian (2019)

② ZAO (a face swap app in mainland China)

faced fierce criticisms as its privacy policy gave

the company “free, irrevocable, permanent,

transferable, and relicenseable” right to use

users’ images 9

Source: BBC News (2019)

① Personal Information Security Specification:

➢ A national standard on personal data protection implemented in 2018

➢ Stringent personal data protection requirements, e.g. accountability,

risk assessment

➢ Special requirements on biometric data, e.g. explicit consent,

separate storage

➢ Considered as mainland China’s response to EU’s GDPR10

② First court case on the use of facial

recognition technology:

A law professor sued the Hangzhou Safari Park in 2019

for its use of facial recognition to authenticate season

ticket holders at the entrance.

11

③ Facial recognitional national standard:

➢ To be published by the National Information Security

Standardization Technical Committee in 2 years

➢ In response to concerns about the wide application of the

technology and the personal data security risk

12

13

④ First comprehensive Personal Data

Protection Law in mainland China:

• Included in the legislative plans of the National People’s

Congress

• Currently being drafted, and expected to be published within 2020

Use of surveillance camera and other

surveillance technology is

restrained

High privacy expectation of

individuals

Government is conscious about

protecting individuals’

privacy rights

14

Multi-functional Smart Lampposts Pilot Scheme

• Launched in 2019

• 400 smart lampposts across HongKong

• For monitoring traffic, air quality,weather, etc.

• Original design of panorama camerareplaced by thermal detectors andLidar (Light Imaging Detection andRanging) in response to publicconcern about surveillance

15

Technological measures tackling COVID-19

taken by the world

Location Tracking

Big Data Analytics

Contact Tracing

16

Measures taken by the mainland

Chinese government

1) Real-name

registration on

public transport

Source: SCMP (2020) 17

2) Health-Rating APPs➢ Categorise citizens based on

their risks of infection (red,

yellow or green)

➢ Those with red or yellow

health codes will face travel

restictions

Source: WSJ (2020)

18

3) Facial recognition of

masked faces

➢ Chinese tech companies are

developing algorithms that spot

people not wearing masks;

➢ And algorithms that identify

people with masked faces.

Source: Abacusnews (2020)

19

4) Drones ➢ Drones modified to fight COVID-

19, e.g.-

➢ disperse public gatherings;

➢ issue warnings to individuals;

➢ remotely check people’s

temperatures;

➢ spray disinfectants; and

➢ enforce home quarantine orders.

Source: SCMP (2020) 20

5) Telecom carriers utilizing

user data pool

➢ Chinese telecom companies

leveraging the data pool of China's

billion-plus smartphone users to

offer insights;

➢ Help monitor the traffic to help

local governments take better

precautionary measures.

Source: China Daily (2020)21

1) “Notice on the Protection of Personal Information when

Using Big Data for Joint Support and Defense”

• Released by the Cyberspace Administration of China in

February 2020

• Emphasising privacy principles and cybersecurity requirements

on the collection, use, and disclosure of personal information for

purposes of containing COVID-19

22

2) Urgent notice issued by the Ministry of Transport

• Issued to public transport operators in January 2020.

• Stipulating that passenger information collected in

connection with COVID-19 prevention and control shall

be disclosed only to health authorities.

23

3) Notice issued by the National Health Commission

• Issued in February 2020 to all local health commissions.

• Stating the government’s policy to strengthen the

protection of privacy by enhancing cybersecurity and

ensuring the regulated use of personal data.

24

25

Temporary/ad-hoc measures of collecting personal data for fighting COVID-19 should be cancelled if possible and not made permanent.

Explore the establishment of guidelines and standards for the collection of personal data during extraordinary periods.

Liu Xiaobing, Dean, Public Economy and Management, Shanghai University of Finance

Lian Yu Ming, Head, International Institute for Urban Development, Beijing

Robin Li, CEO, BaiduA regulatory body should be set up with reference to Hong Kong’s PCPD.

(1) Electronic Wristbands + Mobile App

• Electronic wristbands paired

with a mobile apps –

StayHomeSafe – to enforce

home quarantine

• Currently mandatory for all

people coming to HK

26

(1) Electronic Wristbands + Mobile App

• Wristbands do not contain GPS device

• Mobile app does not collect geo-

location data

• Confirm a person is staying at home by

analysing environmental

communication signals such as

Bluetooth, Wi-Fi and geospatial signals27

(2) Online Dashboard

Source: https://chp-dashboard.geodata.gov.hk/covid-19/en.html

• List out patients’ age,

gender and building

resided

• No precise information to

re-identify patients

• Well-balanced between

privacy and information

transparency 28

(3) Other Contact Tracing & Exposure Notification Measures

• Verbal inquiry for contact tracing

• Supercomputer and big data analytics to identify close contacts

• Aggregate statistical data about usage of Octopus card to track the transmission of the virus and identify the risk of infection in various districts

• Location data collected by mobile operators

29

Exemptions under data protection law

• Exemptions under the Personal Data

(Privacy) Ordinance for using identity and

location data:

➢ Section 59 – protection of health

➢ Section 60B – authorisation by law, i.e.

Prevention and Control of Disease (Disclosure of

Information) Regulation

30

• Privacy – fundamental but not absolute; with exemptions (c.f. right to life).

• Must personal data be collected and used?

• Pressing need for such measures (e.g. pandemic and short of vacancies)?

• Serve the legitimate purposes of protecting public health?

• A rational connection between the measures and the legitimate purposes?

• No more than necessary measures to achieve the legitimate purposes?

• Benefits of achieving the legitimate purposes not disproportionate to the

encroachment and inroads made into the fundamental right of personal data

privacy, i.e. not imposing an unacceptable harsh burden on the affected individuals?31

32

Two media statements issued by GPA Executive Committee in March and May 2020

“The universal data protection

principles in all our laws will

enable the use of data in the public

interest and still provide the

protections the public expects.”

“The success of contact tracing

apps will depend on the trustof individual members of the

public… … privacy by

design is a key enabler…”

TRUST

→ Enabler of technological

success33

Explainability

Ethics

Privacy

Transparency

Thank you